[techpeace]

If one of your developer's Campfire (assuming y'all still use this) accounts gets popped, does the attacker now have the ability to deploy to production, or is there some other mitigating factor not mentioned here?

[sciurus]

I'd be surprised if they don't have additional security. Here's some info on what Box did to add authentication and authorization to Hubot commands.

https://cloud.app.box.com/dodatx2015

[techpeace]

Thanks! This is exactly what I was looking for.

[lukasm]

VPN would be my guess.